Claude inference hooks: an allow-or-deny check before every prompt

How inference hooks work

Your organization (or its security vendor) runs an AI security server: an HTTPS endpoint. When someone sends a prompt, Anthropic posts the conversation transcript to that endpoint, signed with the Standard Webhooks scheme, and waits for a verdict. On allow, inference proceeds; on deny, the request never reaches the model and the user sees your reason plus a standing message from your admins.

• Two events: prompt, before each governed inference request, and tool_call, before the tool calls in Claude's response run, when Validate tool calls is on.
• One setup for the whole organization: claude.ai, Claude Desktop and mobile, Claude Code (CLI included), Cowork, Claude for Microsoft 365, Claude Tag and Claude in Chrome.
• What your server sees: the transcript text, tool calls and results, and text extracted from attachments. Never raw file or image bytes, system prompts or tool definitions.
• Verdicts are only allow or deny. Rewriting or redacting a prompt isn't supported.
• Each denial is logged in your organization's Activity Feed.

Inference hooks vs Claude Code hooks vs the Compliance API

The names are close, but they are three different tools. Claude Code hooks are configured per project or per user and run on the developer's machine; inference hooks are set once by the organization and run on Anthropic's side.

How to set up inference hooks

You need the Owner or Primary owner role (Admin isn't enough) and a public HTTPS endpoint on port 443. Tunnels such as ngrok are blocked, so host the test server on a domain you control.

1. Allow the feature

   In claude.ai, open Organization settings → Data and privacy and turn on Allow for your organization under Inference hooks. This doesn't start inspection: Enforce verdicts stays off.

2. Add your endpoint and keep the signing secret

   Click Configure, enter your https:// URL and save. The first save shows a webhook signing secret once: store it, because your server uses it to verify every request.

3. Add headers and test

   Add up to 16 static headers so your server can authenticate Anthropic, then click Test connection. It sends a synthetic prompt and reports the verdict and the round trip.

4. Return a verdict as HTTP 200 JSON

   Answer every request with HTTP 200 and an action. A non-200 status is a failure, not a deny.

   // Allow the request
   { "action": "allow" }
   
   // Deny it: deny_reason is shown to the user (max 500 characters),
   // reference_id goes to your compliance activity feed only
   {
     "action": "deny",
     "deny_reason": "This prompt appears to contain customer card data.",
     "reference_id": "scan_01HXPT4R9V"
   }

5. Choose failure handling and a timeout

   Block the request fails closed, Allow the request fails open. The verdict timeout is 1 to 10,000 ms, 5,000 by default; a slow verdict counts as unreachable. Repeated failures trip a circuit breaker that applies your failure setting until the server recovers.

6. Roll out gradually, then enforce

   Start in Shadow mode, which sends verdicts without blocking anything, inspect a percentage of requests, exclude custom roles if needed, then turn on Enforce verdicts. Changes reach every server in about a minute.

Source: Claude Platform docs, Inference hooks

Limits and gotchas

• Enterprise only: not on Team, Pro or Max, not for Claude Platform (API) organizations, and not on Amazon Bedrock or Google Cloud.
• Image-only content, such as a screenshot of a document, isn't inspected because raw bytes are never sent.
• A denied message stays in the transcript and is resent with every later message. In Claude Code, run /rewind to the prompt that brought it in, or /clear to start over.
• Some of Anthropic's own background model calls aren't governed, such as hosted Claude Security scans, Code Review on GitHub pull requests and smart reports. Running /code-review locally in Claude Code is governed.
• In voice mode a small share of tool calls isn't sent, so don't rely on hooks as the only control there.
• The same announcement added a security center (beta) that compares your Claude, Cowork and Claude Code settings with Anthropic's recommended configuration, plus centralized management and access controls in beta.

Why this matters for agents that run on their own

When Claude Code works unattended, on a schedule or in the background, nobody reads each prompt before it's sent. Inference hooks give a company one inline check on every request and tool call, wherever the agent runs, and shadow mode lets security teams tune the policy before blocking anything. For per-project guardrails on a single machine, Claude Code's own hooks and permission rules still apply; see Claude Code plan mode for the permission modes.

Guardrails for AI employees that work while you're away

Crewmark turns a Claude Code, Codex, DeepSeek Harness or OpenCode session into an AI employee with a role, a goal and working hours, woken on a heartbeat to take the next issue from a board. On a Claude Enterprise plan, inference hooks check its prompts like anyone else's.

1. Decide what needs your yes

   Each employee asks before risky actions, such as publishing, merging or spending money, and you approve from one inbox.

2. Keep the record on the board

   Every issue keeps the employee's comments and status changes, so you can review what it did next to your security team's logs.

3. Let the heartbeat start the work

   During working hours the employee wakes every 15, 30 or 60 minutes in the same conversation; see how to make Claude Code proactive and what an AI employee is.

Claude inference hooks FAQ